You always have access to the user's unhashed passwords when they submit it. In authentication, hash the raw password and invert case and the hash that. Then co

You always have access to the user's unhashed passwords when they submit it. In authentication, hash the raw password and invert case and the hash that. Then compare the stored hash against both hashed passwords from the input. There is no need to store the password in plain text in any form.